Triage: Responding to a disruption - An excerpt from: AIA Professional
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
Triage: Responding to a disruption An excerpt from: Architect’s Guide to Business Continuity Interim release published March 2020 Update published June 2021 The 2021 update includes a refined Business Continuity Planning Process that includes a resource inventory, business impact analysis, recovery strategies and solutions, risk assessment, and risk treatment plan, updated worksheets, new interactive workbooks and case studies, and additional checklist items in the guide’s section on preparing for and responding to a disruption.
We want to hear from you!
Take this survey and tell us about your
experience using this guide.
“The AIA supports policies, programs, and practices that promote adaptable and resilient
buildings and communities. Buildings and communities are subjected to destructive forces
from natural and human-caused hazards such as fire, earthquakes, flooding, sea level rise,
tornadoes, tsunamis, severe weather, and even intentional attack. The forces affecting the built
environment are evolving with climate change, environmental degradation, population growth,
and migration; this alters long term conditions and demands design innovation. Architects
design environments that reduce harm and property damage, adapt to evolving conditions,
and more readily, effectively and efficiently recover from adverse events. Additionally, the AIA
supports member training and active involvement in disaster assistance efforts, providing
valuable insights and aid to communities before, during, and after a destructive event.”
–AIA Resilience and Adaptation Position Statement, approved December 2017
Legal notice
Copyright © 2020, 2021. The American Institute of Architects. All rights reserved. The
information provided is for informational purposes only and not intended to provide professional
advice of any kind, whatsoever. If the advice of a professional is needed, you should consult your
own specialized advisors or counsel appropriate for your specific set of circumstances.
Recommended citation
The American Institute of Architects, (June 2021). Architect’s Guide to Business Continuity.
The American Institute of Architects. (aia.org/resources/6282340-architects-guide-to-
business-continuity--:56)
Architect’s Guide to Business Continuity, Published March 2020. Updated June 2021.
All rights reserved American Institute of Architects © 2020, 2021
Architect’s Guide to Business Continuity 2Triage: such disruptions, these checklists are intended to
ease the burden of unforeseen impacts and get
Responding to
the firm back up and running as soon as possible.
Alternatively, this section may be a helpful reference
when developing employee responsibilities for times
a disruption of disruption (see step 1 of the business continuity
planning process).
Sometimes a disruption occurs before embarking When a disruption occurs, it’s important to reflect on
on a business continuity plan or the hazard event the experience and update your business continuity
exceeds the anticipated impacts. When unexpected planning documentation accordingly. Reflecting on
disruptions occur, the shock can be paralyzing. your experience and understanding what to do (or
Extreme weather, cyberattacks, and the sudden loss not do) when a disruption occurs can help the firm
of a team member are three common disruptions navigate the unexpected as well as better plan for
a firm might experience. If you’ve experienced an future hazard events.
extreme weather event, cyberattack, or sudden loss
of a team member, the checklists linked within the “In
the event of:” graphic can help guide the firm through
recovery. Informed by firms that have experienced
E X T R E M E W E AT H E R
In the event of:
Business continuity planning means
preparing for disruption. Here’s what to do
if an extreme weather event, cyberattack, or
key personnel vacancy happens to you.
Click the title of each checklist to jump to
recommended actions.
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 3In the event of: Extreme weather
Extreme weather can keep a firm from reopening its office doors, delay projects, and turn your personal life upside
down. Below are a few recommendations to help you should extreme weather strike. Keep in mind, when an extreme
weather event occurs, your firm, as well as your broader community, may be affected. If employees have lost their
home or had family members hurt due to an environmental hazard event, they may not be available to assist the firm.
If a hazard event is forecasted
Hazard events such as heavy precipitation events, storms, and extreme heat events are more likely to
be forecasted while hazard events such as earthquakes or tornadoes will have significantly less notice.
Sign up for local emergency alerts.
Monitor emergency operations center’s notices and evacuation status.
Communicate with internal team. Team assignments may change to focus on preparing for a
forecasted hazard event. Confirm with employees as to whom they will report to during evacuation.
Additionally, employees will need to know if or when the office will close in order to plan for their own
preparations and safe evacuation.
Ensure physical facilities are secured to the extent possible. Preparations will vary based on
the hazard event forecasted. Ensure recent photographs of the office/equipment are available for
potential insurance claims.
Create a go box for each project. Archive projects in the design phase in a common, accessible
location and make all information available electronically and accessible for remote work. Employees
can assist with preparing a go box for each project, including critical information for remote work and
project continuity: drawings, project manuals, contracts, notebooks, etc. Assemble these materials in
a banker’s box or weatherproof box, and remove the box from the threat area should evacuation be
required.
Ensure files and contacts are backed up and current login info to the remote server is available.
Ensure engineering/facilities employees are scheduled in a manner that provides maximum
coverage. Consider staggering work schedules and having on-call employees available.
Photograph projects under construction: If there is time, it is good practice to photograph projects
under construction with a date stamp, including completed sections and materials stored on the job
site—if there is a loss, the architect may be part of the claim team for the builder’s risk insurance.
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 4Obtain flash drives, chargers, and other supplies for potential evacuation. Depending on the
hazard event forecast and your office setup, this may include removal of critical in-house computer
hardware, original software files, cameras, projector, license stamps, laptops, rolodexes, password
log, checkbooks, tax files, bank records, insurance records, etc.
Conduct external outreach. Prior to a forecast hazard event, when feasible send email
communications to clients, consultants, contractors, and other contacts describing the office
status. Project managers can share any updated contact information as the primary person in
charge of a project and identify an alternate contact if they are unavailable.
Set out-of-office messages. Electronic messages with alternative contact information can be posted
to regular communication channels including phone, email, and shared information sites and indicate
a potential delay for replies. Prepare social media posts for interruption and recovery procedures.
Support past clients. When a hazard event approaches or a reminder of hazard risk occurs,
past clients may scramble for information; as time permits, you may remind them about owners
and maintenance information previously provided for operation systems, warranties, and other
potentially useful features. Remind your current clients of emergency notices from authorities.
Never promise that a building will withstand a threat; maintenance and construction defects may
result in performance that is less than the designed condition.
Initial disaster response
Emphasize life safety. Prioritize human life and safety over property in all actions during a hazard
event (i.e., leave the building rather than stay to fight a fire or collect valuables; break a window or
door to get out if necessary).
Identify available communication resources. Check channels of communication such as office
phones, fax lines that don’t go through a phone system, office internet, cell phone service, etc.
Ensure everyone at the site is safe. Take roll of all employees in the office and triage for physical
or emotional injuries. If safe to do so, encourage employees to stay at home or return home. If
shelter is needed and the office is stable, welcome employees to shelter in place.
Determine if employees not present at the office are safe after the hazard event. Contact
employees and follow up if there is no response.
Communicate the type of hazard event underway and action(s) to be taken. For example,
lockdown procedures, exits that are no longer viable, etc.
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 5Activate shelter in place procedures as necessary and reasonable. If a prolonged stay is Learning from
necessary (i.e., overnight because no transit is accessible), rearrange common areas if necessary
and assign employees who are there to coordinate food and sleeping areas. disruption
If the power is out, unplug appliances. Desktop computers, monitors, TVs, plotters, printers Extreme weather event: Few
and other equipment should be unplugged to protect them against power-surge damage when people had the resources to rebuild
power returns. immediately after the hurricane, so
we organized community meetings
Allow individuals to work remotely if circumstances permit. about rebuilding, participated in the
charrettes, and volunteered where
we could to help with disaster
assessments and planning for
future improvements.
Business is operational –Firm owner
Re-evaluate project schedules. For projects in design, identify the schedule impacts from the
closure and advise the client. One or more projects may have to be put on hold if employees
are unable to work, the contractor cannot access the site, or a number of other challenges are
encountered. Contact the authority having jurisdiction to determine emergency procedures
or ordinances available for obtaining permits and resuming work. Coordinate with the clients,
contractors, and other parties to determine an acceptable solution; it may require teaming up with
an unaffected colleague or alternate contractor. If the client terminates a project due to the changed
conditions, work with them to identify an alternative lot, size, scope, schedule, or delivery method,
if possible. If there is no opportunity for a modified contract, AIA contracts provide for termination
expenses to be paid to the architect. Government and other client’s contracts often include force
majeure clauses allowing for contract termination in case of extended force majeure events.
Conduct outreach to clients, community groups or government agencies, and design
partners to determine new project opportunities (repairs, retrofits). Make your skills available
to former clients for technical assistance. Become an active part of any relevant recovery efforts.
Help the community analyze reconstruction principles and priorities by joining committees,
providing assistance in visioning, writing grants, and fundraising.
Be a resource. If a client or essential consultant is displaced, consider the availability of space in
your office to provide temporary workspace for them. Consider allowing colleagues or community
groups to use your office conference space for community meetings; this is an opportunity to
become a hub for information and idea-sharing. If sharing office space is disrupting operations or
too costly, get creative. How could a garage, warehouse, file room, conference room, café, or other
less-used space be utilized for community support? Also contact your local AIA component. They
can help you provide resources to your peers.
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 6Conduct outreach to clients, community groups or government agencies, and design
partners to determine new project opportunities (repairs, retrofits): Make your skills available
to former clients for technical assistance. Become an active part of the recovery efforts. Help
the community analyze reconstruction principles and priorities by joining committees, providing
assistance in visioning, writing grants, and fundraising.
Assess and update plan: Reflect on the experience. What went wrong? What went right? How can
you use these findings to enhance your business continuity plan?
Business is disrupted
Check on impact to employees and provide office status update. Within a certain time frame,
the primary contact should reach out to the team. If the designated time frame is reached without
communication from the primary contact, the secondary contact needs to reach out to employees.
Employees will provide a status update, location, and availability. If they have been affected by the
hazard event, they should contact a designated person to find out how to receive assistance during
the recovery period. Communicate if the office is safe for reoccupation (or an estimated time when
that might be known and communicate to them) and any alternate provisions. If the scope of the
hazard event warrants a change in the office reopening date, communicate this to your team as
soon as possible so they can plan ahead. Communicate any pay impacts that may occur.
Update office website with status information. If the scope of the hazard event warrants a
change in the office reopening date, update the office website with new information.
Determine ability to access the site following a disaster. Confirm with the authority having
jurisdiction (AHJ) that it is safe to enter the facility. If you have AIA SAP-trained employees, this
determination can be made by those trained staff members. The evaluation conducted only informs
your own actions and is not a means of tagging the building, which is the responsibility of the AHJ.
When it is safe to do so, designate firm leaders or employees to enter the disaster area
and review the status of the building and/or projects under construction. If the damage is
significant or access to the building is otherwise restricted, coordination with landlord, building
management, and/or local authorities will be needed.
Retrieve key documents. Collect copies of all key documents and meet with building/fire officials,
landlord, building management to advise status of building; schedule next steps/actions needed.
Contact insurance agent(s) about coverage and claims.
Determine who can return to work. Coordinate with employees to determine who is able to return
to work in person and who needs to work remotely. Adjust project assignments as necessary.
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 7Confirm which staff have access to safe remote work options: If employees cannot return
immediately to work or need personal time off, try to be as flexible as possible.
Restore office space. Contact the insurance claim adjuster to schedule the insurance assessment.
Alternatively, photograph (with date and time stamp) the office “as is” and share documentation to
advise status. If damage is sustained beyond the ability of employees to clean up/repair, schedule
cleanup/repair. If it is not possible to use the office again ever, arrange for lease of a new location.
If seeking a temporary or permanent new location, consider the availability of housing in the area,
access challenges, and the mental health impacts of returning to an impacted area.
Contact your local AIA component. After a hazard event, state and local components may be
reached via email, phone, or social media depending on the impacts. Reach out when you are able;
they can be a resource to you.
After event
Examine/evaluate projects under construction. If projects under construction experience
damage, use the hazard event to learn more and share across the firm.
Examine/document damaged projects and determine the cause of failures. Architects need to
continually educate themselves about the causes of building failures in order to prevent them from
happening in the future.
Assess and update plan. Reflect on the experience. What went wrong? What went right?
How can you use these findings to enhance your business continuity plan? Document findings
and capture requirements for business continuity planning documentation (or apply updates if
documentation already exists).
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 8From disaster to resilience dividends
How a small Iowa firm managed disruption mere three days after the storm. If it had been any longer, employees who had
Courtesy of Kyle Martin, AIA | Martin Gardner Architecture managed to stabilize their own properties first would have begun working out of
our Strawberry Point office. For many, the internet came back on with the power,
THE EVENT: Iowa derecho and some semblance of normal communications was available.
It was just a regular Monday in August 2020. The local news broadcast warnings
about a strong storm coming through, and sure enough, tornado sirens went off After our Marion office regained power, we invited our employees and their
right at noon. From our office building’s second-story windows, we watched the families to utilize the office as a resource. It was August and unbearably hot. Our
storm roll in like we always do, but we quickly realized the storm was unusually employees appreciated the opportunity to charge their phones and cool off while
fierce. Of our seven employees in our Marion, Iowa, office, only three were in the maintaining COVID-19 social distancing precautions.
office that day. If we’d known the true strength of the storm, we would’ve sought
shelter in the basement. But escaping to the basement requires us to go outside As they were able, the assigned project managers began reaching out to
to a separate entrance—a path that quickly became unsafe as the storm roared our clients. In the main disaster area, it took about 30 days before normal
on. Instead, we watched as pieces of neighboring buildings flew by, listening for construction activities resumed. Some of our projects shut down because clients
creaks, and wondering if our roof would hold. The power went out and nearly all and contractors had to deal with their own post-disaster problems.
of the 150-year-old trees in the park next door fell victim to the 100+ mph winds.
A small handful of buildings in the area caught fire due to broken gas lines. After Our early power restoration also allowed us to be a resource to our community.
the storm, we filed out of the building along with our neighbors, taking inventory Trying not to sit idly by, we transformed our services to help our clients and
of what was broken and in awe of the strength of what we would soon learn was the general community navigate the post-disaster reconstruction process:
a derecho. developing an “intake” process to efficiently process phone calls that came in,
giving preliminary advice for people who just needed a little guidance, speaking
POST-DISRUPTION: with insurance representatives, taking part in building evaluations with insurance
Our first task was to check on our employees. Due to the COVID-19 pandemic—as adjusters, providing contact information for other specialized consultants like
well as the weather forecast—our staff was dispersed between the office and their structural engineers, and referring people to the appropriate contractors. We
own homes. We didn’t know what communication networks were operational, so developed a standardized form to document damage with space for photos and
we tried them all: text message, cell phone, landline, email. In one way or another, calculating our fees.
we eventually heard from everyone. Many were dealing with storm damage at
their own homes, but everyone was safe. It quickly became clear that power and In some ways, this community support became a type of guerilla marketing,
communications were down across the entire region; cell service was spotty at leading to new work for our firm. We prioritized the people and entities already
best, and there was no internet. Travel through the metro area was also heavily in our network. We took to social media, alerting our clients, government
impacted as trees and debris blocked streets block after block in every part officials, and community members that we were available to help. We canvassed
of the county. The day after the storm we put out a message on social media community social media pages to see who posted about damage in their area so
that our Marion office—located just outside Cedar Rapids—was impacted, but we could potentially respond to their needs. We developed a script of questions
our Strawberry Point office—located an hour north of Marion—was still fully and recommendations.
operational and that we would reach out to our clients and friends as soon as we
were able to begin recovery efforts. We had just completed a project with local county government, which made it
natural for us to reach out to them again. We then contracted with Linn County
Because of how the power grid is networked through Marion, the local authorities to assess 80-some buildings and develop project scopes for derecho repairs. In
prioritized returning power to the central business district, where our Marion office some cases, we referred the repairs to the original architect or engineer. Now,
is located. Therefore, our office was one of the first buildings to regain power—a we’re developing project bid packages to repair the remainder of the county’s
building stock.
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 9LESSONS LEARNED
• Know your dependencies: Understand the vulnerability of your firm’s office by
finding out the priority level for utility service to your office’s neighborhood. Think
through backups for each of the services you use.
• Be flexible: The COVID-19 pandemic had positioned us to be able to work from
home; however, residential neighborhoods didn’t regain power nearly as quickly
as our office. Having two small regional offices—plus the ability to work from
home—gave us multiple options to continue our work.
• Reach out proactively: In every disaster there are ways for architects to be a
resource. Don’t assume clients and community members know to contact you
for help. Be proactive. Let people know what your resources, skills, and abilities
are. Identify the social networks that the community finds useful and be on them.
Being part of an active chamber of commerce can be powerful in times of need.
• Trust but verify: After a disaster, the community is inevitably flooded with
“storm chasers.” Most of the contractors and tradesmen that arrive post-disaster
genuinely want to help, and many, but not all, are qualified to perform the work.
However, fraud is common post-disaster, so review contracts carefully.
REFLECTING ON RISK
Table 36: Marion Hazard Prioritization in the 2019-2024 Linn County Multi-
jurisdictional Hazard Mitigation Plan categorizes tornadoes and windstorms, as
well as thunderstorms, lighting, and hail as “priority 1” hazards. While not explicitly
named in the plan, a derecho18 is a large, fast-moving complex of thunderstorms
with powerful straight-line winds.
18 “Derecho,” Merriam-Webster.com Dictionary, Merriam-Webster, https://www.merriam-webster.com/dictionary/derecho. Accessed 2021.
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 10In the event of: Cyberattack
Cybersecurity and digital information loss are growing concerns across all industries. Should your firm be held
hostage by ransomware or experience the loss of sensitive data, below are recommended next steps.
During event:
Identify disruption type. Contact IT upon initial suspicion of a cyberattack or abnormality to minimize
continued risk. Take notice of the scope of the disruption. Is it impacting only a single computer, just your
office, or firm-wide? Quickly analyzing the problem can assist in reducing spread and damage. If in place,
follow the technology recovery plan to identify and address the disruption as planned (where possible) and
adapt as the situation warrants.
Identify cybersecurity breach type. Understand the cyberattack. Is it easily resolved, or does it involve
significant damage? Analyzing the loss and its impact will help determine if the information lost or pirated is
worth recovering. Backup systems, when correctly designed, deployed, and appropriately isolated, can nullify
piracy events as damaged data can simply be recovered. In certain situations, if internal IT expertise is not
available, contacting a security incident management company as soon as possible may be the best approach
to understanding the scale and scope of the disruption.
Contact cyber liability insurance carrier. Many policies offer assistance to help mitigate the risk during the
attack.
Contact legal counsel. The firm will need to understand the contractual and legal implications of the
cyberattack to help identify and prioritize next steps.
Mitigate or nullify attack when possible. If the source of malicious/unwanted activity can be located
through IT forensics, disable accounts, change passwords, shut down internet connectivity, isolate office
network, or take other appropriate actions.
Analyze data loss and recovery methods. Firms are technology-based. Analyzing loss needs to quickly
happen once an cyberattack occurs to understand what is impacted by a cyberattack, and to minimize
additional cyberattacks. An IT specialist can analyze and discuss recovery.
Prioritize restoration. Identify each application criticality as a basis for prioritizing the recovery process. For
example, CAD or BIM systems and associated files may be more critical than office productivity software.
The ease with which an application can be restored as well as the business cycle will impact criticality. For
example, a down payroll system the day before payday will have a higher criticality than the day after payday.
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 11Engage internal team leaders on extent of loss if documents are unrecoverable. Cyberattacks
impact the entire firm and can quickly spiral out of control. Make everyone aware of the attack, what is
impacted, how it is resolved, and how they should proceed in notifying outside sources.
Notify clients, consultants, and other deadline-related sources of the breach. Cyberattacks
can occur without an employee even knowing they have allowed access. They can be passed on
from reliable sources, such as consultants, accountants, professionals, or what appear to be secure
websites (banks, government). It is important to notify a project team so they understand the reason
for possible delays and so they understand how it is being resolved.
After event
Review documentation and interview stakeholders. Review documentation recorded during the
cyber event and interview stakeholders to understand their perspectives and insights. If a technology
recovery plan was used, discern where the technology recovery plan was insufficient, and make
corrections and additions based on lessons learned. Update the incident response plan as needed.
Implement more robust backup, disaster recovery, and monitoring systems. Depending on the
disruption source, impact, and perceived future risk, implement improved backup systems to reduce
impact and time-to-recovery during a future data loss or cybersecurity attack.
Educate employees on cyber risks/vulnerabilities. Understand why the attack occurred and
educate employees on how to minimize future risk. Was it from a source deemed reliable? Asking
the source through a separate process before responding or opening links often will greatly
diminish attacks.
Implement changes based on broader lessons learned. Execute changes to routine testing,
drills, procedural reviews, and user training to mitigate future risks. Ensure lessons learned are
embodied to prevent future reoccurrence.
Assess. Reflect on the experience. What went wrong? What went right? How can you use these
findings to enhance your business continuity plan? Document findings and capture requirements
for business continuity planning documentation (or apply updates if documentation already exists).
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 12In the event of: Key team member vacancy
Whether unexpected death, sudden departure, or temporary inability to work, a key team member vacancy
can be detrimental to the daily needs of a firm. Below are a few tips should this happen to you.
After event:
Assess team impact. Determine the essential activities of the key team member and find the
right team member to fill the gaps. Recognize that tasks may need to be re-prioritized. Even in
a large firm, it may not be reasonable for remaining team members to take on substantial new
responsibilities on top of existing assignments.
Communicate employee changes to the entire staff with transparency. Anticipate when
temporary circumstances will resolve or change, and communicate both unknowns and expectations.
Notify clients. Communicate relevant aspects of the succession plan to clients with care,
individually, and with clear assignment of new team members. Recognize that some clients will be
disappointed—take steps to address their concerns.
Revise website and marketing materials as needed. Remove the individual from firm
literature, website, social media, etc., to avoid clients/vendors asking for a team member who
is no longer available.
Provide training and mentorship for team members with new responsibilities: Reassess other
work expectations and reprioritize. Employees experiencing new duties may feel quickly overwhelmed.
Try to provide time and flexibility to accommodate onboarding to new duties and projects.
Communicate the ongoing strength of the firm through the media, community partners,
pro bono service, etc
If a death is experienced, celebrate the life of the team member (as appropriate) and allow
the office time to grieve. This will be unique to the situation. Examples of celebrating the life of
the team member include establishing a scholarship to recognize the loss and contributions of the
team member, hosting a memorial with a firm-wide and external message (particularly when the
individual has an industry-level presence), providing an internally focused message, and offering a
very local office message with clear support for the remaining family. Where appropriate, the office
may also consider offering support to the team member’s family.
Assess. Reflect on the experience. What went wrong? What went right? How can you use these findings
to enhance your business continuity plan? How might the firm perform more detailed succession
planning and/or cross-training to minimize the impact of unexpected vacancies in the future?
Architect’s Guide to Business Continuity • Prepare for and respond to disruption • Triage: Responding to a disruption 13You can also read
